tina4-nodejs 3.13.120 → 3.13.122

package/types/cli/src/commands/generate.d.ts

@@ -115,3 +115,19 @@ export interface GeneratorSpec {
 }
 export declare const GENERATORS: Record<string, GeneratorSpec>;
 export declare function generate(what: string, name: string, extraArgs?: string[]): Promise<void>;
+/**
+ * Programmatic entry point for in-process consumers (MCP tools, tests, hosted
+ * agents) — does everything `generate()` does EXCEPT print.
+ *
+ * Reset the resolution → dispatch to the requested generator → populate `next[]`
+ * → return the envelope. Files still land on disk (unless `--dry-run` is passed
+ * in `extraArgs`); only the human "Created …" per-file log and the
+ * `printResolution()` output are suppressed (via `jsonMode: true`, the same
+ * suppression `--json` uses on the CLI).
+ *
+ * Used by the MCP `migration_create` tool (packages/core/src/mcp.ts) so the
+ * ADR-0063 `generate_v1_1` envelope drives every surface (CLI, MCP, tests)
+ * without a subprocess round-trip.
+ */
+export declare function generateProgrammatic(what: string, name: string, extraArgs?: string[]): Promise<ResolutionEnvelope>;
+export declare function generateMigration(name: string, flags: Record<string, string | boolean>, fieldsOverride?: Array<[string, string]>, tableOverride?: string, emitTest?: boolean): void;

package/types/cli/src/commands/migrateCreate.d.ts

@@ -1 +1 @@
-export declare function createMigration(description?: string): Promise<void>;
+export declare function createMigration(args?: string[]): Promise<void>;

package/types/core/src/middleware.d.ts

@@ -303,6 +303,21 @@ export declare class RequestLogger {
  */
 export declare class SecurityHeadersMiddleware {
     static beforeSecurity(req: Tina4Request, res: Tina4Response): [Tina4Request, Tina4Response];
+    /** Warn-once ledger for the default-CSP heads-up (per process). */
+    private static cspDefaultWarned;
+    /**
+     * Warn once per process that the default CSP is in force (TINA4_CSP unset).
+     *
+     * Secure-by-default keeps `default-src 'self'` (SECHDR-DEC-01), but that
+     * default is invisible: it blocks runtime-injected inline styles, cross-origin
+     * fonts/scripts/CDNs, `data:` URIs, and cross-origin WebSocket/XHR (a separate
+     * API or LiveKit host) — and the failure surfaces only in the browser at
+     * runtime, long after a deploy has gone green. So the framework says so once,
+     * naming the escape hatch. It NEVER fails the boot or a request — logging a
+     * heads-up must not be the reason the server or a request dies. Fires only when
+     * TINA4_CSP is ABSENT; setting it (even to empty) is an explicit opt-in.
+     */
+    private static warnCspDefaultOnce;
     /**
      * True when the client request is HTTPS. Proxy-aware and byte-parity with
      * Python (request.is_secure_scheme), PHP (Request::isSecureScheme) and Ruby